How do you extract JSON logs that have value =?

rakeshksingh — Sat, 27 Oct 2018 19:38:42 GMT

Hi All,

I am looking for a field extraction at that time at indexing for JSON file format.

{"field1": "a=\"1", b=\"\",c=\"\",d=\"4", "field2": "x=\"a",y=\"\", "field3": "value3",}

getting logs in Splunk as below

field1 =a="1", b="",c="",d="4"
field2=x="a",y=" "

But, Looking for key value pair for a,b,c,d,x,y in the form of fieldname and fieldvalue.
a=1
d=4
x=a
Tried with spath,xmlkv, but no luck.

Could you please help me out in this.

Thanks in advance

Re: How do you extract JSON logs that have value =?

valiquet — Sun, 28 Oct 2018 13:38:37 GMT

SED-alter=s/=\\"/:\\"/

rakeshksingh — Mon, 19 Nov 2018 18:15:32 GMT

its not working.

Could you please suggest any other way ?